From: Willy Tarreau <w@1wt.eu>
Date: Mon, 27 Jul 2026 08:03:04 +0000 (+0200)
Subject: BUG/MINOR: h1: report the right error position on authority/host mismatch
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=84c3c96e9135e333d13814958acb57129049e2f8;p=thirdparty%2Fhaproxy.git

BUG/MINOR: h1: report the right error position on authority/host mismatch

When an absolute-form request target does not match the Host header value,
h1_headers_to_hdr_list() reports the error at two places depending on whether
the message must be blocked or only captured:

	if (h1m->err_pos < -1) {
		state = H1_MSG_LAST_LF;
		ptr = host.ptr; /* Set ptr on the error */
		goto http_msg_invalid;
	}
	if (h1m->err_pos == -1) /* capture the error pointer */
		h1m->err_pos = v.ptr - start + skip; /* >= 0 now */

The strict path correctly points at the Host header value while the tolerant
path uses <v>, which at this point still holds the value of the *last* parsed
header field, whatever it was. So with "option
accept-unsafe-violations-in-http-request" enabled, the offset stored in
h1m->err_pos, later used by h1_capture_bad_message() and reported by "show
errors", designates an unrelated part of the message.

Let's use host.ptr in both paths.

This was introduced by commit 25bcdb1d9 ("BUG/MAJOR: h1: Be stricter on request
target validation during message parsing") in 3.0-dev12, so it should be
backported to 3.0 and above.
---

diff --git a/src/h1.c b/src/h1.c
index 7a88fb192..6190f4798 100644
--- a/src/h1.c
+++ b/src/h1.c
@@ -1176,7 +1176,7 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
 								goto http_msg_invalid;
 							}
 							if (h1m->err_pos == -1) /* capture the error pointer */
-								h1m->err_pos = v.ptr - start + skip; /* >= 0 now */
+								h1m->err_pos = host.ptr - start + skip; /* >= 0 now */
 						}
 					}
 				}